dnscat2 | 1cd170b02e3f1a53a1ddfa79b026bb6b45729fcf66adedfd3d4cfb229eb733f4N

Sharing

Copy URL

Twitter E-mail

General

Target

1cd170b02e3f1a53a1ddfa79b026bb6b45729fcf66adedfd3d4cfb229eb733f4N
Size

661KB
MD5

d83e2a17cf232f7f79f55f456f072920
SHA1

dfd843e3c81c253dea487b89b39476c6bce8252c
SHA256

1cd170b02e3f1a53a1ddfa79b026bb6b45729fcf66adedfd3d4cfb229eb733f4
SHA512

fdec4f7be01a37b584c2693066e77fe51ab8d3a2d5135eb64d14a8f5d1601661e8cf591a8df829fcb03d92dde6c173926183ddee4c8219b125c9fadfbc01bc30
SSDEEP

6144:U2rqUZQyIH3iJHVtIk0LQOZdTFL94SQqCqPMf87Jc0lYImDHNhbrd:U2rqpyiV9ZNFOSQbqz7Jc0lg

Score

10^/10

dnscat2

Malware Config

Signatures

Detects dnscat2 1 IoCs

resource	yara_rule
sample	tool_dnscat2

Dnscat2 family
dnscat2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1cd170b02e3f1a53a1ddfa79b026bb6b45729fcf66adedfd3d4cfb229eb733f4N

Files

1cd170b02e3f1a53a1ddfa79b026bb6b45729fcf66adedfd3d4cfb229eb733f4N
.exe windows:4 windows x86 arch:x86

e540fdc20529b43465fb097b81b38397

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

dnsapi

DnsQueryConfig

kernel32

CloseHandle
CreatePipe
CreateProcessA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetEnvironmentVariableW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
PeekNamedPipe
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__mb_cur_max
__p___argv
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_errno
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
fopen_s
abort
atoi
calloc
exit
fclose
fprintf
fputc
fread
free
fwrite
isxdigit
localeconv
malloc
memcmp
memcpy
memset
qsort
rand
realloc
setlocale
signal
srand
strchr
strcmp
strerror
strlen
strncmp
time
strstr
strtok
toupper
vfprintf
wcslen
_stat

ws2_32

WSAGetLastError
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/94
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/110
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e540fdc20529b43465fb097b81b38397

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dnsapi

kernel32

msvcrt

ws2_32

Sections

.text Size: 156KB - Virtual size: 155KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 14KB - Virtual size: 14KB

/4 Size: 23KB - Virtual size: 22KB

.bss Size: - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 6KB - Virtual size: 6KB

/14 Size: 2KB - Virtual size: 2KB

/29 Size: 212KB - Virtual size: 211KB

/41 Size: 32KB - Virtual size: 32KB

/55 Size: 73KB - Virtual size: 73KB

/67 Size: 3KB - Virtual size: 2KB

/78 Size: 15KB - Virtual size: 15KB

/94 Size: 29KB - Virtual size: 28KB

/110 Size: 2KB - Virtual size: 1KB

.text
Size: 156KB - Virtual size: 155KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 14KB - Virtual size: 14KB

/4
Size: 23KB - Virtual size: 22KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 6KB - Virtual size: 6KB

/14
Size: 2KB - Virtual size: 2KB

/29
Size: 212KB - Virtual size: 211KB

/41
Size: 32KB - Virtual size: 32KB

/55
Size: 73KB - Virtual size: 73KB

/67
Size: 3KB - Virtual size: 2KB

/78
Size: 15KB - Virtual size: 15KB

/94
Size: 29KB - Virtual size: 28KB

/110
Size: 2KB - Virtual size: 1KB